class Kubeclient::ExecCredentials
An exec-based client auth provide kubernetes.io/docs/reference/access-authn-authz/authentication/#configuration Inspired by github.com/kubernetes/client-go/blob/master/plugin/pkg/client/auth/exec/exec.go
Public Class Methods
run(opts)
click to toggle source
# File lib/kubeclient/exec_credentials.rb, line 9 def run(opts) require 'open3' require 'json' raise ArgumentError, 'exec options are required' if opts.nil? cmd = opts['command'] args = opts['args'] env = map_env(opts['env']) # Validate exec options validate_opts(opts) out, err, st = Open3.capture3(env, cmd, *args) raise "exec command failed: #{err}" unless st.success? creds = JSON.parse(out) validate_credentials(opts, creds) creds['status'] end
Private Class Methods
map_env(env)
click to toggle source
Transform name/value pairs to hash
# File lib/kubeclient/exec_credentials.rb, line 82 def map_env(env) return {} unless env Hash[env.map { |e| [e['name'], e['value']] }] end
validate_client_credentials_status(status)
click to toggle source
# File lib/kubeclient/exec_credentials.rb, line 37 def validate_client_credentials_status(status) has_client_cert_data = status.key?('clientCertificateData') has_client_key_data = status.key?('clientKeyData') if has_client_cert_data && !has_client_key_data raise 'exec plugin didn\'t return client key data' end if !has_client_cert_data && has_client_key_data raise 'exec plugin didn\'t return client certificate data' end has_client_cert_data && has_client_key_data end
validate_credentials(opts, creds)
click to toggle source
# File lib/kubeclient/exec_credentials.rb, line 67 def validate_credentials(opts, creds) # out should have ExecCredential structure raise 'invalid credentials' if creds.nil? # Verify apiVersion? api_version = opts['apiVersion'] if api_version && api_version != creds['apiVersion'] raise "exec plugin is configured to use API version #{api_version}, " \ "plugin returned version #{creds['apiVersion']}" end validate_credentials_status(creds['status']) end
validate_credentials_status(status)
click to toggle source
# File lib/kubeclient/exec_credentials.rb, line 52 def validate_credentials_status(status) raise 'exec plugin didn\'t return a status field' if status.nil? has_client_credentials = validate_client_credentials_status(status) has_token = status.key?('token') if has_client_credentials && has_token raise 'exec plugin returned both token and client data' end return if has_client_credentials || has_token raise 'exec plugin didn\'t return a token or client data' unless has_token end
validate_opts(opts)
click to toggle source
# File lib/kubeclient/exec_credentials.rb, line 33 def validate_opts(opts) raise KeyError, 'exec command is required' unless opts['command'] end